Early detection of disease outbreaks is essential
for authorities to initiate and conduct an appropriate response. A need
for an outbreak detection that monitored data predating laboratory confirmations
was identified, which prompted the establishment of a novel symptom surveillance
system.
The surveillance system monitors approximately 80% of the Danish population
by applying an outbreak detection algorithm to ambulance dispatch data.
The system also monitors both regional and national activity and has a
built-in, switch-on capacity for implementing symptom surveillance reporting
in case of an alert.
In an evaluation with outbreak scenarios it was found that decreasing the
outbreak detection sensitivity from a prediction limit of 95% to one of
99% moderately reduced the time to detection, but considerably diminished
the number of false alerts.
The system was able to detect an increased activity of influenza-like illness
in December 2003 in a timely fashion. The system has now been implemented
in the national disease surveillance programme.

Introduction
New infectious threats such as SARS and human H5N1 infections have necessitated
detection systems that respond in a timely way to emerging epidemics,
allowing authorities to respond at the earliest possible stage. Worldwide
developments concerning biological weapons and terrorism were an additional
driving force for improving public health surveillance and outbreak
response. In case of a covert attack with biological agents the impact
is likely to be multinational due to extensive land, sea and air transport.
Several terrorist organisations have publicly stated their intent to
use unconventional weapons including biological and chemical agents
and the risk of an attack therefore is generally considered as credible.
A number of diagnostic-based disease surveillance systems already operate
in Denmark, including a sentinel surveillance scheme for influenza and
influenza-like illness and a detection system for outbreaks of gastrointestinal
illness such as salmonellosis. These surveillance systems are disease
specific and do not serve as indicators of disease of unknown origin,
including emerging diseases. Furthermore, the delays between outbreak,
confirmed laboratory diagnosis, collection and analysis of results, and,
eventually, notification of the authorities have in the past resulted
in impediments for implementing countermeasures. Unfortunately only a
minority of the established disease surveillance systems in Denmark had
a capability for regional surveillance. If implemented, it could improve
sensitivity in symptoms surveillance and direct diagnostic investigation
to a predefined area.
Given this background, our aim was to develop a disease detection system
that had the capacity to react promptly following an outbreak or attack,
thereby reducing the median outbreak detection time (MOD-Time) and allowing
authorities sufficient time to start outbreak investigation and implement
medical countermeasures such as quarantine, mass vaccination or administration
of antibiotics. Specifically, the goal was to detect outbreaks of severe
illness at an earlier stage than is possible when using traditional sources
of information such as clinical reports and laboratory results. Ambulance
transport data has previously been found to be useful as an early indicator
of increased disease activity unrelated to origin [1], but a thorough
testing with scenarios had not been done. The present paper reports results
from validation and implementation of the system, which has been termed
Bioalarm.

Material and methods
In brief, the surveillance system monitored the activity of ambulance
dispatch data by daily applications of an outbreak detection algorithm
(Level I). In case of an alert due to an increase in the demand for ambulance
transport, a built-in reporting system could be activated (Level II).
The second level served as a switch-on capacity for online recording
of epidemiological data (selected patient symptoms, geographical data
and onset of symptoms) in order to collect information for a preliminary
case definition before patients arrived at the hospital.

Level I:Ambulance dispatch data
In Denmark, ambulance transport data has been recorded for more than
a decade. We collected data on dispatch for emergency medical conditions
from January 2000 to August 2005 from six regions in Denmark and evaluated
regional as well as national activity simultaneously. Data was recorded
at a central registration unit operated by a primary ambulance transport
contractor (Falck A/S). This dataset covered more than 80% of the total
Danish population of approximately 5.4 million people. The data demonstrated
significant variation and included a period with several minor and one
major influenza epidemic.
Incidence data from outbreaks.
Three scenarios were developed to test and optimise the outbreak detection
algorithm. The amplitude (new cases/day) of some of the scenarios was
scaled to fit the regional background transport level of the region where
the scenarios were applied. The epidemiological profiles of the outbreaks
were unaffected.
Scenario I: Outbreak of tularaemia with 100 persons displaying symptoms
due to Francisella tularensis. The incidence curve resulted
from standardised epidemiological calculations [2]. Scenario II: From
the Sverdlovsk outbreak of anthrax in 1979 [3,4] incidence data was collected
and the amplitude of the outbreak was up scaled to a total number of
420 persons contracting the disease. Scenario III: Incidence data from
Madrid in 1981 concerning an outbreak of symptoms later revealed to be
due to the illegal sale of toxin-laced cooking oil causing toxic oil
syndrome (TOS) [5]. The amplitude of the extensive outbreak was downscaled
to a total number of 448 displaying symptoms [FIGURES 1, 2].

Statistical methods
We developed a model in which previous observations were primarily used
to determine the variations, while deviations from the baseline were
evaluated based upon the observations of the most recent day. The model
predicted short term level of transport frequencies one day ahead and
calculated prediction intervals with 95% and 99% limits. The upper limits
were the focus for analysis and defined the alert thresholds. Whenever
transport frequencies increased to above the threshold level of either
95% or 99%, an automatic notification was generated. The statistical
engine consisted of a state space dynamic model with local level combined
with a Kalman smoother [6,7]. The model was calibrated to fit regional
transport frequencies in each region. A user-friendly interface was designed
for day-to-day operation and graphic presentation of events.

Testing
The system was first tested in a dry run on background data alone, defining
the baseline number of alerts and overall stability. Subsequently, background
data for one region with approximately 640 000 inhabitants were spiked
with incidence data from outbreaks. This process created a simulated
data-material that was used to estimate the response times of the system.
The starting point (Day 0) of the epidemiological profiles in the three
scenarios were added to the background data, beginning with the first
day of January 2004, then the second day of January 2004 and so forth
until the end of July 2004 (three scenarios on 182 days, the equivalent
of 546 runs) ([FIGURE 2]. The average, median and maximum outbreak detection
time in days were then recorded after each new starting point for all
three scenarios.

Level II:
For eight days in March 2006, epidemiological data from patients with
emergency medical illnesses in one region with approximately 640 000
inhabitants were collected online, following a command from the Danish
National Centre for Biological Defence (NCBD) (Nationalt Center for Biologisk
Beredskab) Data contained selected patient symptoms, patient characteristics
and geographical information, [TABLE 1]. Paramedics recorded the data
on forms prepared for this purpose and forms were sent by fax to the
NCBD for estimation of baseline values (incidences of symptoms, geographical
distribution, etc.). Subsequently, the data was spiked with epidemiological
symptom data before analysis, in order to simulate a geographically located,
symptom-specific disease outbreak.

ResultsAmbulance dispatch data:
The data was collected from six regional dispatch centres which had median
dispatches ranging from 45 to 130 per day. There were no significant
simultaneous seasonal variations on the six dispatch centrals. At a 95%
detection limit, we expected 109.5 alerts per year, while a 99% limit
resulted in an expected number of 21.9 alerts per year (95%: 5 alerts
every 100 days per region or 18.25 alerts per year per region, 18.25 × 6
= 109.5 alerts/year), (99%: 1 alert every 100 days per region or 3.65
alerts per year per region, 3.65 × 6 = 21.9 alerts/year).
During an influenza epidemic in 2003 the ambulance reporting system issued
13 alerts at the 99% level. Immediately prior to this, one alert had
been issued at the 99% level detection limit. During the period when
the observed numbers of influenza cases were below the National Influenza
Sentinel Registration’s threshold level, the system issued two
alerts. Ambulance dispatch activity, compared with the Sentinel Registration,
is illustrated in Figure 3.

Scenario detection:
When the ambulance dispatch data were spiked with data on the outbreak
scenarios, we were able to detect all outbreaks both at a 95% and 99%
detection limit [FIGURE 1]. Based on daily applications of the algorithm,
a change from a 95% to a 99% detection limit increased the MOD-Time by
1 (scenario I) or 2 days (scenario II and III) [TABLE 2].

Operational issues:
One minor system breakdown occurred during the period of automatic prospective
ambulance transport frequency monitoring, but overall, the system was
operative above 99% of the time. The system updated automatically once
every 24 hours. Running costs were limited; the operating officer checked
the status of the system and the transport level daily and the procedure
required no special skills or training. There was good compliance by
operating officers.

Collection of early epidemiological data, Level II:
During eight days a total of 553 patients were transported as critically
ill medical patients in the selected region. During the same period 243
patients were registered at the NCBD by online faxing of completed ambulance
forms which indicated underreporting (243/553 = 44%). Of the 243 patients,
186 were uniquely identifiable in the ambulance statistics. The remaining
57 patients had erroneous or missing patient identification numbers.

Discussion
Data to monitor early increased disease activity can be obtained from
several sources, including work/school absenteeism and ‘over the
counter’ pharmaceutical sales. We chose to develop a symptom surveillance
system that used ambulance transport data and operated on two levels.
One advantage was that we could make use of existing high-quality ambulance
transport data for achieving a reduction in MOD-Time. The need for an
early unspecified alert in case of abnormal ambulance transport frequency
was accomplished with this model. Our requirements for operational success
were few false alerts, high sensitivity and the ability to adapt in case
of minor regional changes over time. An increased number of patients,
for whatever reason, will, to a variable degree, influence transport
statistics as well as other parameters, such as physician calls and emergency
centre statistics. With increased severity of an outbreak, the degree
of patients requiring ambulance transport will invariably be high, thereby
increasing the likelihood of a system alert. However, the system has
limitations in case of a larger mild disease outbreak where only a smaller
fraction of patients require transport by ambulance. Overall, the system
responds rapidly to differences in epidemiological profiles for instance
as a result of a massive patient influx or geo-clusters.

Level I
The results from initial testing indicated that the system had a low
degree of false alerts. On two consecutive days in December 2003 the
system reported increased activity. This episode heralded the beginning
of a subsequently well-documented influenza epidemic in Denmark [8].
This suggests that the system was able to trace and report this outbreak
from an early stage, in a timely fashion compared with existing monitoring
systems which rely on manual reporting and compiling of results. By adding
scenarios to background transport activity we were able to determine
the MOD-Time of the system from a precise event. Balancing sensitivity
and number of false alerts was a key issue. By the use of a 99% detection
limit we achieved sensitivity almost as high as with the 95% detection
limit, but significantly reduced the number of false alerts. This was
essential for the performance and acceptability of the system. The scaling
of some scenarios influenced only the amplitude of the outbreak, but
maintained the unique epidemiological profile of the outbreak curve which
best simulated a real event. The system responded rapidly in all cases
and would, with regards to scenario III, have notified authorities at
an earlier stage than documented by the historical facts. The prospective
testing of the system demonstrated reliability, few false alerts and
good compliance with operating officers.
The Kalman filter is a recursive estimator. This means that the only
estimated state from the previous time step and the current measurement
are needed to compute the estimate for the current state. Thus, the chosen
method was robust against ‘noise’ generated from previous
spikes of ambulance dispatches and changes in the baseline by, for example,
organisational changes or other artefacts. On the other hand, the system
would not respond to a slow increase in the number of ambulances. Hence,
the system may have limited sensitivity to detect an outbreak from a
continuous source or an outbreak of a disease with a long and variable
incubation time.

Level II
In case of an alert at level I, the responsible officer at the regional
ambulance dispatch centre has to determine the credibility and severity
of the alert and to a certain degree what caused it. In most cases
the alert is easily explained by known events and local conditions
leading to an increased demand, but ultimately the duty officer might
choose to upgrade monitoring to second level preliminary epidemiological
investigation after consulting with the NCBD, epidemiologists and public
health officials. In case further investigation is needed, the completed
ambulance reporting forms containing information such as patient data,
patient symptoms and pickup time/place, will be the object of a further
centrally guided investigational process and cluster analysis. Reporting
of symptoms by faxed forms during testing supplied the basis for further
investigation. However, this proved to be a bottleneck, since forms
were not completed for a large proportion of patients transported on
the days of the exercise, while other forms were difficult to match
with actual patients in the database of the ambulance contractor. This
illustrates the need for the automatic collection of epidemiologically
relevant data and the development of a standardised data collection
procedure for further improvement of the system. Testing of automatic
online distribution and transferral of patient data, such as temperature
and ECG from ambulances to emergency wards, is being conducted by the
ambulance contractor.
Small outbreaks with a limited number of exposed persons over a number
of weeks, such as the American anthrax outbreak in 2001, would be difficult
to detect with ambulance dispatch surveillance. However, medium to large
sized outbreaks with a disease with or without potential epidemic can
be difficult to recognise in the very early stages unless statistical
real time evaluation is available, as demonstrated by an outbreak of
salmonellosis in Oregon in 1984 [9]. The outbreak detection system presented
in this study serves as a tool for reducing the essential MOD-Time, through
limited investments, using existing databases and the implementation
of specific reporting procedures.

Acknowledgements
The authors would like to thank the European Union Directorate General
for Health and Consumer Affairs (DG SANCO) for financial support.

Disclaimer: The opinions expressed by authors contributing to Eurosurveillance do not necessarily reflect the opinions of the European Centre for Disease Prevention and Control (ECDC) or the editorial team or the institutions with which the authors are affiliated. Neither ECDC nor any person acting on behalf of ECDC is responsible for the use that might be made of the information in this journal. The information provided on the Eurosurveillance site is designed to support, not replace, the relationship that exists between a patient/site visitor and his/her physician. Our website does not host any form of commercial advertisement. Except where otherwise stated, all manuscripts published after 1 January 2016 will be published under the Creative Commons Attribution (CC BY) licence. You are free to share and adapt the material, but you must give appropriate credit, provide a link to the licence, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.